@or3/cloud 0.1.36 → 0.1.38

package/README.md

@@ -32,6 +32,8 @@ npx @or3/cloud init --public --domain cloud.example.com
 
 OR3 Cloud uses Caddy to obtain and renew HTTPS certificates. It does not
 change your DNS, firewall, Cloudflare, or Tailscale settings.
+The managed public profile forwards its proxy-trust setting into Nuxt runtime
+configuration so HTTPS API requests are not redirected back to themselves.
 
 ## Day-to-day commands
 
@@ -56,6 +58,12 @@ When an adopted legacy deployment used a different container UID, `update`
 rebuilds the data from its checksummed pre-update backup as the hardened
 runtime user. It does not recursively rewrite file ownership in place, and a
 failed migration restores the recorded legacy root owner and snapshot.
+Updates also replace the generated Compose/Caddy files from the target CLI.
+Those files are checksummed into the pre-update backup and restored on a failed
+update, rollback, restore, or interrupted-operation recovery.
+When selecting an exact version, run the matching CLI package, for example
+`npx --yes @or3/cloud@0.1.38 update --to 0.1.38`; the CLI refuses mismatched
+package and image versions so their generated assets cannot drift.
 For a destructive purge, export a fresh backup to a new directory on another
 filesystem first; `remove --purge-data --yes` verifies that export before it
 will delete anything.

package/assets/compose.yaml

@@ -8,6 +8,10 @@ services:
     environment:
       HOST: 0.0.0.0
       PORT: 3000
+      # Nuxt only applies nested runtime-config overrides from NUXT_* names.
+      # Bridge the managed OR3 setting so Caddy's sanitized forwarding headers
+      # are trusted and HTTPS enforcement cannot redirect back to itself.
+      NUXT_SECURITY_PROXY_TRUST_PROXY: "${OR3_TRUST_PROXY:-false}"
       OR3_BASIC_AUTH_DB_PATH: /data/auth.sqlite
       OR3_SQLITE_DB_PATH: /data/sync.sqlite
       OR3_STORAGE_FS_ROOT: /data/storage

package/dist/cli.mjs

@@ -27,7 +27,7 @@ import { dirname, basename, isAbsolute, join, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createGunzip } from "node:zlib";
 var execFile = promisify(execFileCallback);
-var PACKAGE_VERSION = "0.1.36";
+var PACKAGE_VERSION = "0.1.38";
 var IMAGE_REPOSITORY = "ghcr.io/saluana/or3-chat";
 var ASSET_ROOT = resolve(fileURLToPath(new URL("../assets/", import.meta.url)));
 var STATE_SCHEMA_VERSION = 1;
@@ -794,15 +794,107 @@ async function readPassword(flags) {
   validatePassword(password);
   return password;
 }
+function managedAssetNames(mode) {
+  return ["compose.yaml", ...mode === "public" ? ["compose.public.yaml", "Caddyfile"] : []];
+}
+async function installManagedAssets(directory, assets) {
+  await mkdir(directory, { recursive: true, mode: 448 });
+  const token = randomBytes(4).toString("hex");
+  const staged = [];
+  try {
+    for (const [name, contents] of assets) {
+      const destination = join(directory, name);
+      const replacement = `${destination}.next-${token}`;
+      const entry = {
+        destination,
+        replacement
+      };
+      staged.push(entry);
+      await writeFile(replacement, contents, { mode: 420 });
+      await chmod(replacement, 420);
+      if (await fileExists(destination)) {
+        entry.rollback = `${destination}.previous-${token}`;
+        await copyFile(destination, entry.rollback);
+        await chmod(entry.rollback, 420);
+      }
+    }
+    const applied = [];
+    try {
+      for (const entry of staged) {
+        await rename(entry.replacement, entry.destination);
+        applied.push(entry);
+        await chmod(entry.destination, 420);
+      }
+    } catch (error) {
+      for (const entry of applied.reverse()) {
+        if (entry.rollback)
+          await rename(entry.rollback, entry.destination);
+        else
+          await rm(entry.destination, { force: true });
+      }
+      throw error;
+    }
+  } finally {
+    for (const entry of staged) {
+      await rm(entry.replacement, { force: true }).catch(() => {
+        return;
+      });
+      if (entry.rollback)
+        await rm(entry.rollback, { force: true }).catch(() => {
+          return;
+        });
+    }
+  }
+}
 async function copyAssets(directory, mode) {
-  await copyFile(join(ASSET_ROOT, "compose.yaml"), join(directory, "compose.yaml"));
-  await chmod(join(directory, "compose.yaml"), 420);
-  if (mode === "public") {
-    await copyFile(join(ASSET_ROOT, "compose.public.yaml"), join(directory, "compose.public.yaml"));
-    await copyFile(join(ASSET_ROOT, "Caddyfile"), join(directory, "Caddyfile"));
-    await chmod(join(directory, "compose.public.yaml"), 420);
-    await chmod(join(directory, "Caddyfile"), 420);
+  const assets = new Map;
+  for (const name of managedAssetNames(mode)) {
+    assets.set(name, await readFile(join(ASSET_ROOT, name)));
+  }
+  await installManagedAssets(directory, assets);
+}
+async function snapshotManagedAssets(directory, mode, backupDir) {
+  const assetDir = join(backupDir, "managed-assets");
+  await mkdir(assetDir, { recursive: true, mode: 448 });
+  await chmod(assetDir, 448);
+  const checksums = {};
+  for (const name of managedAssetNames(mode)) {
+    const destination = join(assetDir, name);
+    await copySecure(join(directory, name), destination);
+    checksums[name] = await sha256File(destination);
+  }
+  return checksums;
+}
+async function verifiedManagedAssetContents(backupPath, manifest) {
+  const checksums = manifest.managedAssetSha256;
+  if (!checksums)
+    return;
+  const expected = managedAssetNames(manifest.mode).sort();
+  const actual = Object.keys(checksums).sort();
+  if (actual.length !== expected.length || actual.some((name, index) => name !== expected[index])) {
+    throw new Error(`Backup ${manifest.backupId} has an invalid managed asset inventory.`);
+  }
+  const assets = new Map;
+  for (const name of expected) {
+    const expectedSha = checksums[name];
+    if (!expectedSha || !/^[0-9a-f]{64}$/i.test(expectedSha)) {
+      throw new Error(`Backup ${manifest.backupId} has an invalid checksum for managed asset ${name}.`);
+    }
+    const source = join(backupPath, "managed-assets", name);
+    const actualSha = await sha256File(source);
+    if (actualSha !== expectedSha) {
+      throw new Error(`Backup managed asset checksum mismatch for ${name}. Expected ${expectedSha}, got ${actualSha}.`);
+    }
+    assets.set(name, await readFile(source));
   }
+  return assets;
+}
+async function restoreManagedAssets(directory, backupPath, manifest) {
+  const assets = await verifiedManagedAssetContents(backupPath, manifest);
+  if (!assets)
+    return false;
+  await installManagedAssets(directory, assets);
+  return true;
 }
 async function checkPublicPrerequisites(domain) {
   validateDomain(domain);
@@ -1161,6 +1253,7 @@ async function createBackup(directory, state, env) {
     await stopProject(directory, state.mode);
     await volumeArchive(directory, state.mode, env, backupDir);
     await copySecure(deploymentPaths(directory).env, join(backupDir, "config.env"));
+    const managedAssetSha256 = await snapshotManagedAssets(directory, state.mode, backupDir);
     const manifest = {
       schemaVersion: 1,
       backupId,
@@ -1171,6 +1264,7 @@ async function createBackup(directory, state, env) {
       dataSha256: await sha256File(join(backupDir, "data.tgz")),
       dataBytes: volumeSize,
       configSha256: await sha256File(join(backupDir, "config.env")),
+      managedAssetSha256,
       mode: state.mode,
       domain: state.domain,
       composeProject: state.composeProject,
@@ -1219,6 +1313,7 @@ async function readManifest(backupPath) {
     if (configActual !== manifest.configSha256)
       throw new Error(`Backup configuration checksum mismatch for ${manifest.backupId}.`);
   }
+  await verifiedManagedAssetContents(backupPath, manifest);
   return manifest;
 }
 async function dataVolumeFreeBytes(directory, mode, env) {
@@ -1259,6 +1354,7 @@ async function restoreBackupData(directory, state, env, backupPath) {
     stopAttempted = true;
     await stopProject(directory, state.mode);
     await copySecure(join(backupPath, "config.env"), deploymentPaths(directory).env);
+    await restoreManagedAssets(directory, backupPath, manifest);
     await restoreVolumeArchive(directory, state.mode, backupEnv, backupPath);
     const restoredEnv = parseEnv(await readText(deploymentPaths(directory).env));
     await startProject(directory, state.mode, restoredEnv);
@@ -1490,9 +1586,13 @@ async function recoverCommand(directory) {
         throw new Error(`Backup ${manifest.backupId} configuration does not match its manifest.`);
       }
       assertBackupMatchesDeployment(manifest, backupEnv, loaded.state, loaded.env);
+      if (pending.targetVersion !== PACKAGE_VERSION) {
+        throw new Error(`This interrupted update targets OR3 ${pending.targetVersion}. Run \`npx --yes @or3/cloud@${pending.targetVersion} recover\` so the image and generated assets match.`);
+      }
       try {
         if (pending.targetImageDigest)
           await pullAndRequireImage(pending.targetImage, pending.targetImageDigest, `OR3 ${pending.targetVersion}`);
+        await copyAssets(loaded.directory, loaded.state.mode);
         await startProject(loaded.directory, loaded.state.mode, loaded.env);
       } catch (replacementError) {
         await restoreBackupData(loaded.directory, loaded.state, loaded.env, backupPath);
@@ -1627,6 +1727,11 @@ async function backupExportCommand(directory, backupId, destination) {
     for (const file of ["data.tgz", "config.env", "manifest.json"]) {
       await copySecure(join(backupPath, file), join(dest, file));
     }
+    if (manifest.managedAssetSha256) {
+      for (const name of managedAssetNames(manifest.mode)) {
+        await copySecure(join(backupPath, "managed-assets", name), join(dest, "managed-assets", name));
+      }
+    }
     const dataSha = await sha256File(join(dest, "data.tgz"));
     if (dataSha !== manifest.dataSha256) {
       throw new Error(`Exported data.tgz checksum mismatch for ${manifest.backupId}. Expected ${manifest.dataSha256}, got ${dataSha}.`);
@@ -1637,6 +1742,7 @@ async function backupExportCommand(directory, backupId, destination) {
         throw new Error(`Exported config.env checksum mismatch for ${manifest.backupId}.`);
       }
     }
+    await readManifest(dest);
     const destinationDevice = (await stat(dest)).dev;
     await mkdir(deploymentPaths(directory).exports, { recursive: true, mode: 448 });
     const receipt = {
@@ -1650,7 +1756,12 @@ async function backupExportCommand(directory, backupId, destination) {
     };
     await writeSecure(join(deploymentPaths(directory).exports, `${manifest.backupId}.json`), `${JSON.stringify(receipt, null, 2)}
 `);
-    const bytes = (await stat(join(dest, "data.tgz"))).size + (await stat(join(dest, "config.env"))).size + (await stat(join(dest, "manifest.json"))).size;
+    let bytes = (await stat(join(dest, "data.tgz"))).size + (await stat(join(dest, "config.env"))).size + (await stat(join(dest, "manifest.json"))).size;
+    if (manifest.managedAssetSha256) {
+      for (const name of managedAssetNames(manifest.mode)) {
+        bytes += (await stat(join(dest, "managed-assets", name))).size;
+      }
+    }
     console.log(`Exported backup ${manifest.backupId} (${bytes} bytes) to ${dest}`);
     console.log("The exported copy contains credentials and secrets. It is owner-only (0600); keep it off-host.");
     if ((await stat(backupPath)).dev === destinationDevice) {
@@ -1697,6 +1808,9 @@ async function updateCommand(directory, flags) {
   const targetVersion = stringFlag(flags, "to")?.trim() ?? PACKAGE_VERSION;
   if (!isVersion(targetVersion))
     throw new Error(`--to must be a complete semantic version such as ${PACKAGE_VERSION}.`);
+  if (targetVersion !== PACKAGE_VERSION) {
+    throw new Error(`This CLI contains deployment assets for OR3 ${PACKAGE_VERSION}. Run \`npx --yes @or3/cloud@${targetVersion} update --to ${targetVersion}\` so the image and generated assets match.`);
+  }
   if (targetVersion === state.appVersion)
     throw new Error(`The deployment is already on OR3 ${targetVersion}.`);
   const targetImage = imageFor(targetVersion);
@@ -1728,6 +1842,7 @@ async function updateCommand(directory, flags) {
         });
       }
       await writeSecure(deploymentPaths(loaded.directory).env, serializeEnv(nextEnv));
+      await copyAssets(loaded.directory, state.mode);
       if (migrateLegacyVolume) {
         await restoreVolumeArchive(loaded.directory, state.mode, nextEnv, backup.backupDir);
       }
@@ -2738,15 +2853,19 @@ export {
   validatePassword,
   supportedImageArchitectures,
   stateFromEnv,
+  snapshotManagedAssets,
   serializeInitialCredentials,
   serializeEnv,
   selectPruneTargets,
+  restoreManagedAssets,
   requiredArchiveSpace,
   redact,
   purgeVolumesFromState,
   parseFlags,
   parseEnv,
+  managedAssetNames,
   isVersion,
+  copyAssets,
   checkResolvedLoopbackBinding,
   buildEnv,
   buildCredentialsResetScript,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@or3/cloud",
-  "version": "0.1.36",
+  "version": "0.1.38",
   "description": "Install and operate the OR3 Cloud container distribution",
   "type": "module",
   "license": "GPL-3.0",